What data was exposed in the Tieu Dental Corporation breach?

According to the notification letter and supporting filings, the compromised data included: Full name, Date of birth, Social Security number, Medical records, Treatment plans, Prescription information, Health insurance information.

Was Tieu Dental Corporation attacked by a ransomware group?

No threat actor has publicly claimed responsibility for the Tieu Dental Corporation breach. The incident is categorized in the HHS OCR portal as a hacking.

What is HealthConsent and how does it help with the Tieu Dental Corporation breach?

HealthConsent is an independent health-data privacy service. We help affected individuals stop the ongoing flow of their health information by filing HIPAA restriction requests, FTC Health Breach Notification Rule deletion requests, and state-law deletion requests across providers, insurers, Health Information Exchanges, prescription networks, and data brokers. Credit monitoring offered by Tieu Dental Corporation addresses identity-theft risk; HealthConsent addresses the longer-tail problem of your exposed health data continuing to be sold and shared by other entities downstream.

Active breach tracker Bay Area, CA Disclosed March 5, 2026

Tieu Dental Corporation Data Breach 2026: 8,918 California Oral Surgery Patients Exposed. SSN + Prescriptions in Scope. What To Do

Q: How do I know if I am affected by the Tieu Dental Corporation data breach?

Tieu Dental Corporation is mailing notification letters directly to affected individuals. If you have received care or services from Tieu Dental Corporation (also operating as South Bay Oral & Maxillofacial Surgery) in the period leading up to March 2026 and you have not received a letter, contact the entity directly. 8,918 individuals were confirmed affected in the HHS OCR filing.

Q: Should I file a lawsuit over the Tieu Dental Corporation data breach?

4 plaintiffs' firms have publicly announced investigations or filed complaints related to the Tieu Dental Corporation breach: Lynch Carpenter (publicly investigating), Bryson Harris Suciu & DeMay (publicly investigating), The Lyon Firm (publicly investigating), Potter Handy (publicly investigating). We are not a law firm and cannot give legal advice; consult your own attorney to evaluate your options.

Tieu Dental Corporation (operating as South Bay Oral & Maxillofacial Surgery), a California oral surgery practice with two Bay Area offices, disclosed in March 2026 a July 2025 network intrusion exposing names, Social Security numbers, medical records, treatment plans, prescriptions, and health insurance information for 8,918 patients. 12 months Experian IdentityWorks offered. Here is what to do.

You have options. Scroll for the exact action steps, what your provider’s response covers, and what your health data needs beyond credit monitoring.

By HealthConsent Editorial Last updated May 15, 2026 Sources & methodology

Timeline

Jul 28, 2025

Unauthorized network access begins

Jul 29, 2025

Discovery and containment

Jan 11, 2026

Forensic data review concludes; scope confirmed

Mar 5, 2026

Filed with CA AG and HHS OCR; individual notifications mailed

Jul 28, 2025

Unauthorized network access begins

Jul 29, 2025

Discovery and containment

Jan 11, 2026

Forensic data review concludes; scope confirmed

Mar 5, 2026

Filed with CA AG and HHS OCR; individual notifications mailed

Data exposed

High-risk identity

Enables financial + identity theft

Date of birth Social Security number

Health records

Don't expire and can't be reissued

Medical records Treatment plans Prescription information

Contact & insurance

Phishing + targeted scams

Full name Health insurance information

Class actions filed by

These firms have publicly announced investigations. You may be eligible to join. We are not a law firm and cannot give legal advice.

Lynch Carpenter (publicly investigating) Bryson Harris Suciu & DeMay (publicly investigating) The Lyon Firm (publicly investigating) Potter Handy (publicly investigating)

If you received a letter

Your action plan, in five steps.

You have more rights than the notification letter explains. Each step below is a concrete thing you can do today. Full detail and timing in the sections that follow.

Accept credit monitoring

It’s the floor of the response. Take it.

Freeze your credit

Free at Equifax, Experian, TransUnion.

File IRS Form 14039

Prevent fraudulent tax return under your SSN.

Review your EOBs

Insurance statements catch medical identity theft early.

Stop the ongoing flow

Credit monitoring doesn’t cover your health records. HealthConsent does.

Jump to step 5: protect my health data

What happened

Tieu Dental Corporation (doing business as South Bay Oral & Maxillofacial Surgery) is a California oral and maxillofacial surgery practice led by Louis Tieu, DDS, MD. The practice operates two offices in the Bay Area: 281 E. Hamilton Avenue, Suite 6, Campbell and 370 W. Dunne Avenue, Suite 2, Morgan Hill.

Between July 28 and July 29, 2025, an unauthorized third party accessed Tieu Dental’s network. The practice discovered and contained the intrusion on July 29, 2025. The forensic data-review concluded on January 11, 2026. Tieu Dental filed with the California Attorney General and HHS OCR on March 5, 2026 and mailed individual notification letters — confirming 8,918 affected individuals.

No ransomware group has publicly claimed responsibility. No leak-site listing has been observed.

The CA AG sample letter is labeled “Letter A — Adult SSN,” indicating SSN exposure for the adult cohort and implying a separate minor-cohort letter variant given the pediatric oral surgery population.

What was stolen

Full name, date of birth
Social Security number
Medical records
Treatment plans
Prescription information
Health insurance information

What Tieu Dental is offering

12 months of complimentary Experian IdentityWorks membership (credit monitoring + identity-theft resolution)
Dedicated response line: 844-425-3616

What to do

Enroll in Experian IdentityWorks through the activation code in your letter.
Place free credit freezes at all three bureaus. Full SSN is in scope.
File IRS Form 14039.
If your child was a patient, freeze their credit at all three bureaus (minors require manual outreach with proof of guardianship). The pediatric exposure profile creates long-tail synthetic-identity-theft risk.
Stop the ongoing flow of your oral-surgery treatment data. HealthConsent files HIPAA restriction requests so the prescription and treatment data exposed in this breach is not continuously re-shared.

Continue reading

Stop your data from spreading further

Credit monitoring covers your wallet. HealthConsent covers your health records.

Your stolen diagnoses, test results, and medical record numbers don’t expire when the free credit-monitoring window ends. HealthConsent automates HIPAA restriction requests and opt-outs across providers, insurers, HIEs, and prescription networks so the data taken in this breach can’t keep being shared and sold by other entities downstream.

Protect my health data

Cancel anytime · Family plan covers spouses + dependents

Sources & further reading

Official HHS OCR Breach Portal: ocrportal.hhs.gov

About this page

This page is compiled from public regulatory filings, the breached entity’s own disclosures, and reporting from established healthcare-privacy outlets. Some sections are assembled with the help of automated research and may contain errors, summaries that lag the underlying source, or details that have since been revised. Treat it as a starting point, not legal advice or an authoritative record. If you spot something inaccurate, the linked sources above are the canonical record. For questions about your individual situation, contact the breached entity directly or consult a licensed attorney.